From snsadv@lac.co.jp Thu Jul 19 00:05:53 2001
From: "snsadv@lac.co.jp"
To: bugtraq@securityfocus.com
Date: Thu, 19 Jul 2001 14:18:44 +0900
Subject: [SNS Advisory No.37] HTTProtect allows attackers to change the protected file using a symlink
[The following text is in the "iso-2022-jp" character set]
[Your display is set for the "US-ASCII" character set]
[Some characters may be displayed incorrectly]
-----------------------------------------------------------------------
SNS Advisory No.37
HTTProtect allows attackers to change the protected file using a symlink
Problem first discovered: Mon, 4 Jun 2001
Published: Wed, 18 Jul 2001
----------------------------------------------------------------------
Overview
---------
HTTProtect is a security product released by Omnisecure
(http://www.ominisecure.com) which prevents users from changing
and deleting file on the ext2 file system.
Even if attackers gain root privilege, it prevents them from
changing or deleting protected files.
But there is a problem which attackers can change protected files
bypassing the access-control.
Problem Description
-------------------
Even if attackers have the root privilege, protected files cannot
be changed, but they can change protected files under these conditions:
1.Attackers can make symlink in a writable directory(ex. /tmp)
2.They are the owner of the target file or they have root privilege.
example: (A protected file is /opt/www/html/index.html)
$ ln -s /opt/www/html/index.html /tmp/foo
$ vi /tmp/foo (cat /tmp/hack.html > /tmp/foo)
Tested Version
--------------
HTTProtect 1.1.1
Tested on
---------
RedHatLinux 6.2-J(Kernel 2.2.14-50)
Status of fixes
---------------
Patch is available on Omnisecure Web site now.
$B!J(Bhttp://www.omnisecure.com/products/http/Linux/1.1.1/index.htm$B!K(B
Discovered by
-------------
(TANIDA Fusao / LAC)$B!!(Btanida@lac.co.jp
Disclaimer
----------
All information in these advisories are subject to change without any
advanced notices neither mutual consensus, and each of them is
released as it is. LAC Co.,Ltd. is not responsible for any risks of
occurrences caused by applying those information.
References
----------
Archive of this advisory:
http://www.lac.co.jp/security/english/snsadv_e/37_e.html
------------------------------------------------------------------
Secure Net Service(SNS) Security Advisory
Computer Security Laboratory, LAC http://www.lac.co.jp/security/